Java IoT Authors: Elizabeth White, Liz McMillan, Pat Romanski, Roger Strukhoff, Yeshim Deniz

Related Topics: Agile Computing, Linux Containers, @CloudExpo, Cloud Security

Agile Computing: Blog Feed Post

Linux is Not the Answer to Security Problems

There’s nothing specific to the operating system here: it’s all about the browser and deception

Malicious links served up in a browser are OS agnostic. They don’t care about the OS because the target is people, not technology.

In response to the problem of links and trust put forth in a recent post a reader replies that the answer to “evil links” is simply to run Linux instead of Windows.

the very best solution is to run something other than windows, and with ubuntu at its current state of maturity (and free-ness), why wouldn't you?

I won’t disagree with the assessment of Ubuntu and its current state of maturity. It’s very nice, and I’m enjoying it immensely on my new laptop for a multitude of reasons and Don and I have always insisted that our children run a Linux distribution on their laptops just to minimize the impact (on us to cleaning up) of automatically downloaded and installed viruses and trojans. And the commenter is partially right – running a Linux-derived operating system will indeed protect many users from the automatic installation of many OS-specific (read: Windows) targeted viruses and worms. But it’s not the answer to the problem of malicious content a la links because most of the time the target of the content isn’t technology, it’s the user, and it isn’t relying on an operating system, it’s relying on a browser. And unfortunately, users aren’t going to change their behavior because they’re running Ubuntu or a Mac or Windows or an iPhone.


One of the great things about standards in the browser like CSS and JavaScript and XHTML is the ability to create a rich and interactive user interface and have it consistent across operating systems and browsers. With the increasing reliance on “cloud-based services” for e-mail, personal document management, photo storage and generally any consumer-oriented use of a computer that used to be associated with a fat client now being pushed out to “The Cloud” the browser is the primary interface between the user and the rest of the world

If that interface can be, and it is all the time, leveraged by miscreants to manipulate users into providing their credentials or unknowingly assisting in the spread of links and code that can accomplish the same then the operating system upon which that browser is running is neither an advantage or a disadvantage.

And that’s exactly what’s happening. The benefit to miscreants today is in identity theft; in obtaining credit card and personal information that can used or sold for monetary gain. The old “destroy your computer” viruses of the 1990s are passé and not in vogue. Today it’s about theft, plain and simple, and almost all viruses that are distributed are done so in the hopes of accomplishing that task. “Viruses” today are keyloggers and applications that turn consumers’ desktops into part of a giant botnet that is performing mass SQL injection attacks with the intent of injecting a link that will entice a user to willingly hand over their identity.

And because it’s well-known that the Web is the Way, miscreants have turned to attacks that target the browser and the trust inherent in hyperlinks, in the visual clues that users take that engender trust like, say, the logo and design of the website. Clickjacking and cloning-based attacks are predicated on the ability to exploit the trust users have for a web site. If it looks like Twitter, or Facebook, or My Banking Institution, then it must be that site. Overlaying a “virtual keylogger” using clickjacking or cloning the site and using a domain name that includes the relevant site name in it is enough to convince a user that they are indeed on the site in question and certainly it must be safe to enter their credentials.

And from that one set of credentials the rest of the integrated, collaborative Web 2.0 world is opened to the miscreant. One set of credentials begets another and if they’re lucky enough to get your web-based e-mail credentials well, it’s like finding a pot of gold at the end of a digital rainbow.

With the exception of trojans and viruses designed to act as part of a larger botnet, there’s nothing specific to the operating system here: it’s all about the browser and deception. MacOS? No problem. Ubuntu? Great. Windows? Don’t care. This is social networking engineering at its finest: manipulating the trust of a user through the same rich interface technologies that have made the operating system irrelevant.

Comes the cloud and now trojans and viruses become even less relevant to the game. Given someone’s credit card and identity a miscreant could easily leverage cloud computing to accomplish what the end-user now will not. Move every consumer to an Ubuntu desktop and miscreants will simply find another way to launch their botnet, and that way likely leads to the cloud. Scalable, on-demand, self-service. It’s a miscreant’s dream


The problem of links and the potentially malicious intent behind them is not one of technology in the traditional sense. Yes, technology is being manipulated to enable the use of links as a deceptive theft mechanism, but technology – whether guns or screwdrivers or clubs or lockpicks – have always had both good and bad uses. The intent of the wielder is always at the root of the issue. The problem is two-fold; first, it’s financially advantageous to miscreants to perpetrate such attacks and second, users are still woefully uninformed about phishing and pharming and avoiding the deceptions inherent across the Interweb today. There doesn’t seem to be much we can do about the first part of the problem and addressing the second is a never-ending battle.

Unfortunately, that’s not due to a lack of trying on the part of information security advocates. Trying to explain how to spot some of these deceptions to a typical consumer is like trying to explain to me how to tell the difference between the sounds a car engine might make when it’s in trouble. You can try, but I likely won’t “get it” or be able to put it into practice. It seems simple to you and I because we’re knee-deep in technology day after day. But for someone who just wants to get their e-mail and post a photo on Flickr and update their Facebook status…it actually is rocket-science and it is that complicated.

The solution will likely eventually be found in technology, it always is, but it won’t be as simple as a change in the operating system because that variable has been largely neutralized thanks to Web 2.0 and “The Cloud.”

Follow me on TwitterView Lori's profile on SlideShare friendfeedicon_facebook AddThis Feed Button Bookmark and Share

Related blogs & articles:

Read the original blog entry...

More Stories By Lori MacVittie

Lori MacVittie is responsible for education and evangelism of application services available across F5’s entire product suite. Her role includes authorship of technical materials and participation in a number of community-based forums and industry standards organizations, among other efforts. MacVittie has extensive programming experience as an application architect, as well as network and systems development and administration expertise. Prior to joining F5, MacVittie was an award-winning Senior Technology Editor at Network Computing Magazine, where she conducted product research and evaluation focused on integration with application and network architectures, and authored articles on a variety of topics aimed at IT professionals. Her most recent area of focus included SOA-related products and architectures. She holds a B.S. in Information and Computing Science from the University of Wisconsin at Green Bay, and an M.S. in Computer Science from Nova Southeastern University.

@ThingsExpo Stories
The IoT Will Grow: In what might be the most obvious prediction of the decade, the IoT will continue to expand next year, with more and more devices coming online every single day. What isn’t so obvious about this prediction: where that growth will occur. The retail, healthcare, and industrial/supply chain industries will likely see the greatest growth. Forrester Research has predicted the IoT will become “the backbone” of customer value as it continues to grow. It is no surprise that retail is ...
Digital Transformation: Preparing Cloud & IoT Security for the Age of Artificial Intelligence. As automation and artificial intelligence (AI) power solution development and delivery, many businesses need to build backend cloud capabilities. Well-poised organizations, marketing smart devices with AI and BlockChain capabilities prepare to refine compliance and regulatory capabilities in 2018. Volumes of health, financial, technical and privacy data, along with tightening compliance requirements by...
Business professionals no longer wonder if they'll migrate to the cloud; it's now a matter of when. The cloud environment has proved to be a major force in transitioning to an agile business model that enables quick decisions and fast implementation that solidify customer relationships. And when the cloud is combined with the power of cognitive computing, it drives innovation and transformation that achieves astounding competitive advantage.
DevOpsSummit New York 2018, colocated with CloudEXPO | DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City. Digital Transformation (DX) is a major focus with the introduction of DXWorldEXPO within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of bus...
Dion Hinchcliffe is an internationally recognized digital expert, bestselling book author, frequent keynote speaker, analyst, futurist, and transformation expert based in Washington, DC. He is currently Chief Strategy Officer at the industry-leading digital strategy and online community solutions firm, 7Summits.
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
Widespread fragmentation is stalling the growth of the IIoT and making it difficult for partners to work together. The number of software platforms, apps, hardware and connectivity standards is creating paralysis among businesses that are afraid of being locked into a solution. EdgeX Foundry is unifying the community around a common IoT edge framework and an ecosystem of interoperable components.
Cloud-enabled transformation has evolved from cost saving measure to business innovation strategy -- one that combines the cloud with cognitive capabilities to drive market disruption. Learn how you can achieve the insight and agility you need to gain a competitive advantage. Industry-acclaimed CTO and cloud expert, Shankar Kalyana presents. Only the most exceptional IBMers are appointed with the rare distinction of IBM Fellow, the highest technical honor in the company. Shankar has also receive...
Enterprises have taken advantage of IoT to achieve important revenue and cost advantages. What is less apparent is how incumbent enterprises operating at scale have, following success with IoT, built analytic, operations management and software development capabilities - ranging from autonomous vehicles to manageable robotics installations. They have embraced these capabilities as if they were Silicon Valley startups.
DXWorldEXPO LLC announced today that ICOHOLDER named "Media Sponsor" of Miami Blockchain Event by FinTechEXPO. ICOHOLDER give you detailed information and help the community to invest in the trusty projects. Miami Blockchain Event by FinTechEXPO has opened its Call for Papers. The two-day event will present 20 top Blockchain experts. All speaking inquiries which covers the following information can be submitted by email to [email protected] Miami Blockchain Event by FinTechEXPO also offers s...
Poor data quality and analytics drive down business value. In fact, Gartner estimated that the average financial impact of poor data quality on organizations is $9.7 million per year. But bad data is much more than a cost center. By eroding trust in information, analytics and the business decisions based on these, it is a serious impediment to digital transformation.
Predicting the future has never been more challenging - not because of the lack of data but because of the flood of ungoverned and risk laden information. Microsoft states that 2.5 exabytes of data are created every day. Expectations and reliance on data are being pushed to the limits, as demands around hybrid options continue to grow.
The standardization of container runtimes and images has sparked the creation of an almost overwhelming number of new open source projects that build on and otherwise work with these specifications. Of course, there's Kubernetes, which orchestrates and manages collections of containers. It was one of the first and best-known examples of projects that make containers truly useful for production use. However, more recently, the container ecosystem has truly exploded. A service mesh like Istio addr...
As IoT continues to increase momentum, so does the associated risk. Secure Device Lifecycle Management (DLM) is ranked as one of the most important technology areas of IoT. Driving this trend is the realization that secure support for IoT devices provides companies the ability to deliver high-quality, reliable, secure offerings faster, create new revenue streams, and reduce support costs, all while building a competitive advantage in their markets. In this session, we will use customer use cases...
Cloud Expo | DXWorld Expo have announced the conference tracks for Cloud Expo 2018. Cloud Expo will be held June 5-7, 2018, at the Javits Center in New York City, and November 6-8, 2018, at the Santa Clara Convention Center, Santa Clara, CA. Digital Transformation (DX) is a major focus with the introduction of DX Expo within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive ov...
DXWorldEXPO | CloudEXPO are the world's most influential, independent events where Cloud Computing was coined and where technology buyers and vendors meet to experience and discuss the big picture of Digital Transformation and all of the strategies, tactics, and tools they need to realize their goals. Sponsors of DXWorldEXPO | CloudEXPO benefit from unmatched branding, profile building and lead generation opportunities.
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, @CloudEXPO and DXWorldEXPO are two of the most important technology events of the year. Since its launch over eight years ago, @CloudEXPO and DXWorldEXPO have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, we provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading...
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereal. Andrew's role at ConsenSys Enterprise is a mul...